CLF-C02 Practice Question 15: Configuration Compliance
AWS Certified Cloud Practitioner (CLF-C02) · Test 2 · question 5 of 10
An internal auditor asks two questions: what inbound rules did a particular security group have on a date three weeks ago, and is every Amazon EBS volume in the account encrypted? The security team also wants noncompliant resources flagged automatically from now on. Which AWS service best meets these needs?
Show answer and explanation
Answer:
AWS Config records the configuration of your AWS resources and how those configurations change over time, so you can see, for example, which port rules a security group had open at a specific time. AWS Config rules continuously evaluate resources as they are created, changed, or deleted, and flag any that violate the desired configuration, such as an unencrypted EBS volume, as noncompliant.
Option A, CloudTrail, is the tempting choice: it records API calls (who changed the security group, and when), but it does not keep a queryable history of each resource's configuration state or evaluate resources against compliance rules. Option C, CloudWatch, collects metrics and logs and raises alarms on operational thresholds; it is not a configuration history or compliance evaluation service. Option D, Trusted Advisor, runs a fixed set of best-practice checks across cost, security, and other categories, but it cannot show a resource's past configuration or evaluate custom rules.
Reference: What Is AWS Config?